none
Audit failures every reboot - Event 5061 - Cryptographic operation - Win 10 Pro 64-bit

    Question

  • Immediately after every reboot of Win 10 Pro 64-bit version 1803, in Event Viewer, there are between two and four Audit Failures for something related to Cryptography.  So my Win 10 machine is insecure?  I have run sfc /scannow  and  Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck.  And I hardly even use my Win 10 machine - there are almost no apps on it yet.  My actual Win 10 build is 17134.706 (version 1803)

    Here are the latest five Cryptography-related Audit Failures, from two reboots:

    LATEST OF FIVE:

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          4/28/2019 12:27:52 PM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
        Security ID:        DESKTOP-3#####N\[My user name]
        Account Name:        [My user name]
        Account Domain:        DESKTOP-3#####N
        Logon ID:        0x3EC24

    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    UNKNOWN
        Key Name:    Microsoft Connected Devices Platform device certificate
        Key Type:    User key.

    Cryptographic Operation:
        Operation:    Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-28T16:27:52.339705400Z" />
        <EventRecordID>19582</EventRecordID>
        <Correlation />
        <Execution ProcessID="880" ThreadID="948" />
        <Channel>Security</Channel>
        <Computer>DESKTOP-3#####N</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-21-3591163430-416291016-3566129944-1001</Data>
        <Data Name="SubjectUserName">[My user name]</Data>
        <Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
        <Data Name="SubjectLogonId">0x3ec24</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>


    FOURTH OF FIVE:

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          4/28/2019 12:26:51 PM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
        Security ID:        LOCAL SERVICE
        Account Name:        LOCAL SERVICE
        Account Domain:        NT AUTHORITY
        Logon ID:        0x3E5

    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    UNKNOWN
        Key Name:    [Hex number]
        Key Type:    User key.

    Cryptographic Operation:
        Operation:    Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-28T16:26:51.704606400Z" />
        <EventRecordID>19552</EventRecordID>
        <Correlation />
        <Execution ProcessID="880" ThreadID="1004" />
        <Channel>Security</Channel>
        <Computer>DESKTOP-3#####N</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-19</Data>
        <Data Name="SubjectUserName">LOCAL SERVICE</Data>
        <Data Name="SubjectDomainName">NT AUTHORITY</Data>
        <Data Name="SubjectLogonId">0x3e5</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">[Hex number]</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>


    THIRD OF FIVE:

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          4/28/2019 11:29:28 AM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
        Security ID:        DESKTOP-3#####N\[My user name]
        Account Name:        [My user name]
        Account Domain:    DESKTOP-3#####N
        Logon ID:        0x3EF94

    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    UNKNOWN
        Key Name:    Microsoft Connected Devices Platform device certificate
        Key Type:    User key.

    Cryptographic Operation:
        Operation:    Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-28T15:29:28.196237300Z" />
        <EventRecordID>19387</EventRecordID>
        <Correlation />
        <Execution ProcessID="884" ThreadID="928" />
        <Channel>Security</Channel>
        <Computer>DESKTOP-3#####N</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-21-3591163430-416291016-3566129944-1001</Data>
        <Data Name="SubjectUserName">[My user name]</Data>
        <Data Name="SubjectDomainName">DESKTOP-3#####N</Data>
        <Data Name="SubjectLogonId">0x3ef94</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">Microsoft Connected Devices Platform device certificate</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>


    SECOND OF FIVE:

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          4/28/2019 11:28:27 AM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
        Security ID:        LOCAL SERVICE
        Account Name:        LOCAL SERVICE
        Account Domain:        NT AUTHORITY
        Logon ID:        0x3E5

    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    UNKNOWN
        Key Name:    [Hex number]
        Key Type:    User key.

    Cryptographic Operation:
        Operation:    Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
        <EventRecordID>19363</EventRecordID>
        <Correlation />
        <Execution ProcessID="884" ThreadID="992" />
        <Channel>Security</Channel>
        <Computer>DESKTOP-3#####N</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-19</Data>
        <Data Name="SubjectUserName">LOCAL SERVICE</Data>
        <Data Name="SubjectDomainName">NT AUTHORITY</Data>
        <Data Name="SubjectLogonId">0x3e5</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">[Hex number]</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>


    FIRST OF FIVE:

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          4/28/2019 11:28:27 AM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      DESKTOP-3#####N
    Description:
    Cryptographic operation.

    Subject:
        Security ID:        LOCAL SERVICE
        Account Name:        LOCAL SERVICE
        Account Domain:        NT AUTHORITY
        Logon ID:        0x3E5

    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    UNKNOWN
        Key Name:    [Hex number]
        Key Type:    User key.

    Cryptographic Operation:
        Operation:    Open Key.
        Return Code:    0x80090016
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2019-04-28T15:28:27.709849300Z" />
        <EventRecordID>19363</EventRecordID>
        <Correlation />
        <Execution ProcessID="884" ThreadID="992" />
        <Channel>Security</Channel>
        <Computer>DESKTOP-3#####N</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-19</Data>
        <Data Name="SubjectUserName">LOCAL SERVICE</Data>
        <Data Name="SubjectDomainName">NT AUTHORITY</Data>
        <Data Name="SubjectLogonId">0x3e5</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">UNKNOWN</Data>
        <Data Name="KeyName">[Hex number]</Data>
        <Data Name="KeyType">%%2500</Data>
        <Data Name="Operation">%%2480</Data>
        <Data Name="ReturnCode">0x80090016</Data>
      </EventData>
    </Event>

    So, what are these, and how do we fix?  No guesses - just the real fix.

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003






    • Edited by glnzglnz Wednesday, June 5, 2019 7:22 PM
    Sunday, April 28, 2019 8:35 PM

All replies

  • Hi,

    Follow the below steps to find which process is related to this event:

    1. Open cmd as an administrator and run: tasklist 

    2. Identify the process labeled as PID "884".

    Here is a thread decribes that the issue could related to NVidia driver, try to reinstall it: 

    https://answers.microsoft.com/en-us/windows/forum/windows_10-security/security-audit-failure-event-5061-in-windows-10/6de3cdd6-cb0a-478b-aca6-2f36e2eb85f6

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, April 29, 2019 3:50 AM
    Moderator
  •  

     yilia - my PID 884 is lsass.exe.  What should I do?

    Also, 884 is mentioned in the earliest three of my Audit Failures, but it's PID 880 in the last two.  At this time, under tasklist, there is no process 880.  So is this meaningful?

    Thanks for the link. but the article does not provide an answer.  I do NOT have an Nvidia card - my machine is internal graphics only.  Also, from a different article, I tried "Certutil -store my" but nothing happened.

    Any suggestions?

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003



    • Edited by glnzglnz Monday, April 29, 2019 5:07 AM
    Monday, April 29, 2019 5:01 AM
  • yilia - any thoughts?  Thanks.


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Wednesday, May 1, 2019 6:12 PM
  • I did some more digging.

    On reboot just now, there were three Audit Failures, Event 5061, for Cryptographic operation, all noting Process ID 888, which is lsass.exe, Local Security Authority Process

    So I right-clicked on lsass.exe and looked at its related services, and they are:

    Keylso - CNG Key Isolation - running

    SamSs - Security Account Manager - running

    VaultSvc - Credential Manager - running

    Any ideas what this is, or how to fix?

     

     

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Thursday, May 2, 2019 12:29 PM
  •  

    On every reboot, I am still getting two to four AUDIT FAILURES Event 5061 for Cryptographic Operation.

    Now, I have received a possibly good hint at this link but still need more info:

    https://social.technet.microsoft.com/Forums/windows/en-US/3e88df37-d718-4b1f-ac90-e06b597c0359/event-5061-audit-failures-every-reboot-cryptography-win-10-pro-64bit?forum=win10itprogeneral

    Still need your help - thanks.

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003



    Thursday, May 2, 2019 12:37 PM
  • Hi,

    Sorry for the delay reply.

    From the details you provided, lsass.exe and the related services seem to work fine. 

    We can run SFC /scannow command to scan the integrity of operating system files, and install the latest updates to make sure the machine is up-to-date. 

    Since I notice you have another similar thread, it's recommended to focus on one thread for better support.

    Thanks for your understanding.

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, May 3, 2019 6:06 AM
    Moderator
  •  

    Yilia - at the beginning of this thread, I wrote "I have run sfc /scannow  and  Dism /Online /Cleanup-Image /RestoreHealth many times, with no luck."

    Anyway, I did both again just now and rebooted - still get the AUDIT FAILURES.

    See my post two above - please go to that link and advise what you think.

    Thanks. 


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Friday, May 3, 2019 12:04 PM
  • Update - in the detailed copies of the Audit Failure messages in my post at the start here, the [Hex number] is associated with my One Drive, as I discovered in the registry.

    Is that a clue to the reason for the Audit Failures?

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Saturday, May 4, 2019 3:37 AM
  •  
    IMPORTANT NEW INFO:

    By checking my logs carefully, I can see that the Audit Failures start on the same day that I upgraded from Win 10 Version 1709 to Version 1803 - this past March 17.

    So is this problem baked into 1803?

    But why haven't more people been complaining about it?

    Still need to know how to fix. Thanks.
     

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Saturday, May 4, 2019 6:41 PM
  • Hi,

    I'm not sure if the issue is related to 1803, and we could do a test to downgrade to 1709 to check the symptom. 

    We can also use Windows 10 built-in feedback hub (type feedback hub in search box) to give Microsoft a valuable feedback and I am going to submit this case to Microsoft via our channel.

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, May 6, 2019 8:57 AM
    Moderator
  • Yillia - you wrote, " ... I am going to submit this case to Microsoft via our channel."

    That's GREAT - thanks.

    Audit Failures look like really bad news - like my Win 10 is insecure with some kind of fake installations from the bad guys.  So how will I be able to trust it for personal banking, etc.?  "Audit Failure" related to "Cryptography" should set off nuclear-alert alarms!

    And, by the way, a few days ago, I ran five different anti-virus scans - Windows Defender (two flavors), Malicious Software Removal Tool, Malwarebytes, and (from a different partition) Avast - all clear.

    Please HOUND YOUR FRIENDS AT MICROSOFT RELENTLESSLY for an answer.  RELENTLESSLY.  Please post back here when there's any response.  Thanks.


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003




    • Edited by glnzglnz Monday, May 6, 2019 1:07 PM
    Monday, May 6, 2019 12:43 PM
  • Hi,

    Thanks for your reply.

    You could also upgrade to 1809 to make your machine the latest, then check the symptom. Before there is a response, it's recommended to keep your machine up-to-date by updating.

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, May 8, 2019 7:01 AM
    Moderator
  • Yilia - Has your favorite MS engineer responded with any info on this?

    By the way, in another forum, someone else with the same problem advised that this problem continues in 1809, so I don't want to upgrade from 1803 yet until we make some progress.

    Please push that MS engineer!  These are Audit Failures in Cryptography!

    Thanks again.

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Sunday, May 12, 2019 6:49 PM
  •  
    Yillia - It's ten days since your last reply, and I've discovered that MANY MANY people with Win 10 are having these AUDIT FAILURES in CRYPTOGRAPHY.

    This is serious - it means our WIn 10 PCs are NOT SECURE.

    Is there any news from your Windows engineer?

    Meantime, here's a post from another forum:

    It is very frustrating but all of my searches come up empty with a fix. Only Microsoft knows for sure, or maybe they don't and that is why they have kept quiet on this subject.

    If you do a search for event 5061 you find many people with the audit failure and not all the same reasons (Nvidia for example) It could be a onedrive issue where as we upgrade something is not changed in the registry, or install and uninstall programs the synced file will still remain and causes an audit failure. Your guess is as good as mine. ...

    Some say it is expired certificates and some say phone home programs cause these audits but nobody has ever come up with a fix as it really could be a number of things. My machine is only 8 months old and came with windows 10 on it. There is one post here from 2015 where 170 people marked me too on the "I have the same problem" . I found only one post on it in feedback hub but I really don't think there are too many people that use event viewer or the feedback hub.

    Here is from a search for this audit failure. Lots comes up but no solutions. I have read and read till I am exhausted. Like I said I do not seem to have problems with security because of it but who knows what underlying problems there really may be.

    Here is search.

    https://www.bing.com/search?q=event+5061+audit+failure&form=EDGNB3&mkt=en-us&httpsmsn=1&plvar=0&refig=9ab2eb9a5fb646f4a472a25864512521&sp=2&qs=RI&pq=audit+5061&sk=SC1&sc=2-10&cvid=9ab2eb9a5fb646f4a472a25864512521&cc=US&setlang=en-US

    Thanks.

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    • Edited by glnzglnz Sunday, May 19, 2019 4:30 PM
    Saturday, May 18, 2019 8:45 PM
  • Yilia - any news from your MS engineer?  This is NOT a minor issue - it goes to the security of our machines.

    Please advise status.

    Thanks.

     

     

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Tuesday, May 21, 2019 1:57 PM
  • Hi,

    Sorry for the delayed reply, I'm afraid that there is no news about it.

    If the issue is urgent, it's recommended to open a case with Microsoft for further help.

    Thanks for your understanding.

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, May 22, 2019 7:30 AM
    Moderator
  • Yilia - how do I open a case?  Thanks.

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Wednesday, May 22, 2019 9:10 AM
  • Hi,

    You may try to open a premier support ticket. The premier engineer has a higher level, they may have more resources to help you.

    Support requests
    https://support.microsoft.com/en-us/premier 

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, May 22, 2019 9:27 AM
    Moderator
  • Yilia - In order to use that support website, I need an Access ID Number and Password, which I don't have.

    May I ask you to get back in touch with your MS engineer and ask him to comment here, or to send a fix for the problem?

    Unfortunately, the problem is fundamental.  It seems as if my entire PC is insecure because these are AUDIT FAILURES in CRYPTOGRAPHY.  That's not good

    Thanks.


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003


    • Edited by glnzglnz Thursday, May 23, 2019 7:54 PM
    Thursday, May 23, 2019 6:21 PM
  • Maybe here's a clue - anyway, some additional info.

    I looked at my Credential Manager for the first time ever.  Under "Windows Credentials", under "Generic Credentials", there are a number of entries.  One of them is for "OneDrive Cached Credential", and its User Name is the same [hex number] as I printed for Key Names at the very top of this thread in Fourth, Second and First of Five.  Is this helpful in any way? 

    Unfortunately, none of the Credentials has a User Name that is "Microsoft Connected Devices Platform device certificate", which is the Key Name in the other two of Five that I posted at the top here.

    Thoughts?  Thanks.


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    • Edited by glnzglnz Sunday, May 26, 2019 11:14 AM
    Sunday, May 26, 2019 11:13 AM
  •  

    I did some more digging.  I looked at the sequence of Audit Successes before and after each Audit Failure - maybe they're related?  Maybe the steps mean something?

    In the link below, I have pasted the "General" subwindows for the Event Viewer events closely preceding, including and following each of the two Audit Failures in my most recent bootup. 

    There seems to be some kind of pattern of the machine looking at the key, DELETING it, then looking for it again, then throwing the AUDIT FAILURE - maybe because it just deleted the key and the key isn't there any more - and then re-creating the key.  Is the AUDIT FAILURE just the good result of a test that the key was successfully deleted? 

    But WHY is the machine doing this?  Why delete and recreate?  What's really going on?

    Here's the link to the Word Online document in which I've pasted both Event Viewer sequences.

    <THIS LINK>

    Any thoughts?  (And am I interpreting the events correctly anyway?)


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003


    • Edited by glnzglnz Sunday, May 26, 2019 7:43 PM
    Sunday, May 26, 2019 7:37 PM
  •  

    Bump.  MS really doesn't care about this security risk?

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Wednesday, June 5, 2019 7:18 PM
  • Hello.

    The recommendation is to call MS support to troubleshoot why this is happening on your machine.


    There can be different causes for this to happen, including improper permissions on registry keys, invalid certificates, corrupted certificate files, permissions on the certificates, etc.

    To find the true cause of why this is happening on your machine likely needs some detailed troubleshooting that would best be handled during a support call.

    Here is link to the details on Event ID 5061 from System Integrity

    5061(S, F): Cryptographic operation

    I have seen some reports of this with NVidia Drivers installed.

    you may want to run the following command from a Elevated CMD prompt

    certutil -store -user my

    From the link above

    Key Name [Type = UnicodeString]: the name of the key (key container) with which operation was performed. For example, to get the list of Key Names for certificates for logged in user you can use “certutil -store -user my” command and check Key Container parameter in the output. Here is an output


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights.

    Wednesday, June 5, 2019 10:55 PM
  •  

    Darrell - I've done all of that. There is no video card in my machine.

    And there is no one at MS who will talk to me because this is my home PC - not the office PC.

    certutil -store -user -my did nothing. But maybe I'm missing how to use it - please give me a more specific example. 

    Thanks.

     

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003


    • Edited by glnzglnz Thursday, June 6, 2019 2:32 AM
    Thursday, June 6, 2019 2:31 AM
  •  

    Everyone - check out the possible cure at

    < THIS 10 FORUM POST >

    and the immediately two following posts by the same guy "EyeInTheSky".

    What do you think?

     


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003


    • Edited by glnzglnz Friday, June 7, 2019 3:55 PM
    Friday, June 7, 2019 3:24 AM
  • Updating to 1903 has solved this problem.  Too bad MS won't fix it for 1803 or 1809.


    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Monday, June 17, 2019 5:36 PM
  • Yilia - You proposed this as an answer, but it's not an answer for 1803 or 1809.

    glnzglnz
    ☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
    ☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
    ♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

    Tuesday, June 18, 2019 1:52 AM